EUVD-2026-85752

A security flaw has been discovered in kvcache-ai mooncake up to 0.3.12/0.3.13.post1/0.3.14-rc1. This issue affects the function ScopedSegmentAccess::MountSegment of the file segment.cpp of the component MountSegment Request Processing. Performing a manipulation results in improper access control...

CVE-2026-97149

In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A TempURL signature only covers the method, expiry, and path, and thus the list of disallowed headers is the only defense against a signed PUT request changing what the request does. A...

CVE-2026-97149: Incomplete List of Disallowed Inputs

In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A TempURL signature only covers the method, expiry, and path, and thus the list of disallowed headers is the only defense against a signed PUT request changing what the request does. A...

Linux Distros Unpatched Vulnerability : CVE-2026-66070

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6, matchorigin/1 returned the bare reflected Origin and allowed...

CVE-2026-96763: Improper Access Control

A security flaw has been discovered in kvcache-ai mooncake up to 0.3.12/0.3.13.post1/0.3.14-rc1. This issue affects the function ScopedSegmentAccess::MountSegment of the file segment.cpp of the component MountSegment Request Processing. Performing a manipulation results in improper access control...

PT-2026-98459

Name of the Vulnerable Software and Affected Versions OpenStack Swift affected versions not specified Description An issue exists in the s3api middleware where truncated aws-chunked PUT request bodies are handled incorrectly. An authenticated attacker can exploit this behavior to cause the system...

CVE-2026-93272: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: remoteproc: qcomwcnss: Fix handling the lack of PD regulators in v3 The changes introduced to handle single power domain platforms have swapped the info pointer increment from numpdvregs to numpds, which would shift the info...

PT-2026-98189

Name of the Vulnerable Software and Affected Versions Python Social Auth versions prior to 5.0.0 Description The LoginRadius backend fails to validate the OAuth state during the authentication flow. This leads to a login Cross-Site Request Forgery CSRF, where an attacker can force a victim's...

PT-2026-98234

A flaw has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. The affected element is the function AiKnowledgeDocumentServiceImpl.readUrl of the file AiKnowledgeDocumentServiceImpl.java of the component AI Knowledge Module. This manipulation of the argument url causes server-side...

PT-2026-98127

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the thunderbolt component where the tb-root switch is not properly set to NULL when a domain is stopped. This failure to clear the root switch prevents the tb xdp hand...

CVE-2026-85491: Incomplete Comparison with Missing Factors

Catalyst::Seal versions before 0.03 for Perl allow one request to disable a path or route a later one past an authorization check via a dispatch memo keyed on the request path alone. Catalyst::Seal replaces the dispatcher's prepareaction with a version that memoises how a path resolved: which...

CVE-2026-51994

mcp-remote versions 0.1.32 through 0.1.38 are vulnerable to Server-Side Request Forgery SSRF via the resourcemetadata URL extracted from a remote MCP server's WWW-Authenticate header...

PT-2026-98290

Taskview Community before 1.56.0 contains a missing authentication vulnerability that allows unauthenticated attackers to register arbitrary OAuth clients and take over user accounts by exploiting the OAuth 2.0 Dynamic Client Registration endpoint, which is enabled by default and requires no...

CVE-2026-93354: Initialization of a Resource with an Insecure Default

Taskview Community before 1.56.0 contains a missing authentication vulnerability that allows unauthenticated attackers to register arbitrary OAuth clients and take over user accounts by exploiting the OAuth 2.0 Dynamic Client Registration endpoint, which is enabled by default and requires no...

PT-2026-98129

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the thunderbolt component when the tb xdomain response function is executed. If the tb cfg request function fails to set up a request, such as when the control...

Linux Distros Unpatched Vulnerability : CVE-2026-97149

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A TempURL signature only covers the method,...

PT-2026-97862

Name of the Vulnerable Software and Affected Versions Termix versions 2.5.0 through 2.5.0 Description Authenticated users can configure webhook or ntfy notification channels using destination URLs controlled by an attacker. By using the notification-channel test endpoint, an attacker can trigger...

CVE-2026-79760: Server-Side Request Forgery (SSRF)

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.5.0 until 2.5.1, Termix allows authenticated users to configure webhook or ntfy notification channels with attacker-controlled destination URLs and trigger server-side requests...

CVE-2026-97409: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nvme-fc: Do not cancel requests in io target before it is initialized A new nvme-fc controller in CONNECTING state sees admin request timeout schedules ctrl-ioerrwork to abort inflight requests. This ends up calling...

PT-2026-97923

Name of the Vulnerable Software and Affected Versions Termix versions 2.4.1 through 2.5.0 Description An authenticated administrator can execute arbitrary operating-system commands as the backend process. This occurs because the application fails to properly sanitize domain and email values store...